// Demo Infrastructure Configuration - Rust Meetup 2025
// KCL configuration example showing type-safe infrastructure definition

// Import core schemas
import provisioning.settings as ps
import provisioning.providers.aws as aws
import provisioning.taskservs as ts

// Main infrastructure configuration
config: ps.Settings = {
    // Basic metadata
    main_name = "rust-meetup-demo"
    main_title = "Rust Meetup 2025 Demo Infrastructure"
    description = "Demonstración de Infrastructure as Code con tipos"
    
    // Provider configuration
    provider = {
        name = "aws"
        region = "eu-west-1"
        availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
        
        // Type-safe provider config
        aws_config = aws.AwsConfig {
            profile = "default"
            assume_role_arn = None
            session_duration = 3600
            tags = {
                Environment = "demo"
                Project = "rust-meetup"
                Owner = "JesusPerezLorenzo"
                CostCenter = "engineering"
            }
        }
    }
    
    // Network configuration with validation
    network = {
        vpc_cidr = "10.0.0.0/16"
        
        // Subnets with type checking
        subnets = [
            {
                name = "public-1a"
                cidr = "10.0.1.0/24" 
                availability_zone = "eu-west-1a"
                type = "public"
            },
            {
                name = "private-1a"
                cidr = "10.0.2.0/24"
                availability_zone = "eu-west-1a" 
                type = "private"
            },
            {
                name = "public-1b"
                cidr = "10.0.3.0/24"
                availability_zone = "eu-west-1b"
                type = "public"
            }
        ]
        
        // Security groups with explicit rules
        security_groups = [
            {
                name = "kubernetes-master"
                description = "Security group for Kubernetes master nodes"
                rules = [
                    {
                        type = "ingress"
                        protocol = "tcp"
                        port_range = "6443"
                        source = "10.0.0.0/16"
                        description = "Kubernetes API server"
                    },
                    {
                        type = "ingress"
                        protocol = "tcp"
                        port_range = "22"
                        source = "0.0.0.0/0"
                        description = "SSH access"
                    }
                ]
            },
            {
                name = "kubernetes-worker"
                description = "Security group for Kubernetes worker nodes"
                rules = [
                    {
                        type = "ingress"
                        protocol = "tcp"
                        port_range = "10250"
                        source = "10.0.0.0/16"
                        description = "Kubelet API"
                    },
                    {
                        type = "ingress"
                        protocol = "tcp"
                        port_range = "30000-32767"
                        source = "0.0.0.0/0"
                        description = "NodePort services"
                    }
                ]
            }
        ]
    }
    
    // Server definitions with strong typing
    servers = [
        {
            hostname = "k8s-master-01"
            instance_type = "t3.large"
            
            // Hardware specs with validation
            hardware = {
                cpu_cores = 2
                memory_gb = 8
                storage_gb = 30
                architecture = "x86_64"  // or "aarch64" for ARM
            }
            
            // OS and image configuration
            image = {
                os = "ubuntu"
                version = "22.04"
                arch = "x86_64"
                
                // Custom AMI for optimized performance
                custom_image_id = "ami-0d527b8c289b4af7f"
            }
            
            // Network placement
            placement = {
                subnet = "public-1a"
                security_groups = ["kubernetes-master"]
                assign_public_ip = True
                availability_zone = "eu-west-1a"
            }
            
            // Server-specific metadata
            metadata = {
                role = "kubernetes-master"
                environment = "demo"
                backup_enabled = False
                monitoring_enabled = True
            }
        },
        
        {
            hostname = "k8s-worker-01"
            instance_type = "t3.large"
            
            hardware = {
                cpu_cores = 2
                memory_gb = 8
                storage_gb = 30
                architecture = "x86_64"
            }
            
            image = {
                os = "ubuntu"
                version = "22.04"
                arch = "x86_64"
                custom_image_id = "ami-0d527b8c289b4af7f"
            }
            
            placement = {
                subnet = "private-1a"
                security_groups = ["kubernetes-worker"]
                assign_public_ip = False
                availability_zone = "eu-west-1a"
            }
            
            metadata = {
                role = "kubernetes-worker"
                environment = "demo"
                backup_enabled = False
                monitoring_enabled = True
            }
        },
        
        {
            hostname = "k8s-worker-02"
            instance_type = "t3.large"
            
            hardware = {
                cpu_cores = 2
                memory_gb = 8  
                storage_gb = 30
                architecture = "aarch64"  // ARM for cost optimization
            }
            
            image = {
                os = "ubuntu"
                version = "22.04"
                arch = "aarch64"
                custom_image_id = "ami-0a1b2c3d4e5f6g7h8"  // ARM-optimized AMI
            }
            
            placement = {
                subnet = "private-1a"
                security_groups = ["kubernetes-worker"]
                assign_public_ip = False
                availability_zone = "eu-west-1a"
            }
            
            metadata = {
                role = "kubernetes-worker"
                environment = "demo"
                backup_enabled = False
                monitoring_enabled = True
            }
        }
    ]
    
    // Task services (infrastructure components) with dependencies
    taskservs = [
        {
            name = "kubernetes"
            version = "1.29.0"
            
            // Service-specific configuration
            config = ts.KubernetesConfig {
                cluster_name = "rust-meetup-cluster"
                network_plugin = "cilium"
                container_runtime = "youki"  // Rust-based OCI runtime
                
                // Master node configuration
                master = {
                    node_selector = {"role": "kubernetes-master"}
                    api_server_port = 6443
                    etcd_data_dir = "/var/lib/etcd"
                }
                
                // Worker node configuration  
                workers = {
                    node_selector = {"role": "kubernetes-worker"}
                    max_pods_per_node = 110
                    container_log_max_size = "100Mi"
                }
                
                // Networking configuration
                networking = {
                    service_subnet = "10.96.0.0/12"
                    pod_subnet = "10.244.0.0/16"
                    dns_domain = "cluster.local"
                }
            }
            
            dependencies = []  // No dependencies for base Kubernetes
            install_order = 1
        },
        
        {
            name = "youki" 
            version = "0.3.0"
            
            config = ts.YoukiConfig {
                // Rust OCI runtime configuration
                runtime_name = "youki"
                runtime_path = "/usr/local/bin/youki"
                
                // Performance optimizations
                features = {
                    seccomp = True
                    systemd = True
                    v2 = True
                    wasm = False  // Disable WASM for this demo
                }
                
                // Resource limits
                default_limits = {
                    memory = "512Mi"
                    cpu = "0.5"
                    pids = 1024
                }
            }
            
            dependencies = ["kubernetes"]
            install_order = 2
        },
        
        {
            name = "cilium"
            version = "1.14.0"
            
            config = ts.CiliumConfig {
                // Advanced networking with eBPF
                cluster_name = "rust-meetup-cluster"
                
                // eBPF features
                ebpf = {
                    datapath_mode = "veth"
                    masquerade = True
                    host_routing = True
                }
                
                // Security policies
                network_policy = {
                    enabled = True
                    default_deny = False
                }
                
                // Load balancing
                load_balancer = {
                    algorithm = "round_robin"
                    mode = "dsr"  // Direct Server Return
                }
            }
            
            dependencies = ["kubernetes", "youki"]
            install_order = 3
        },
        
        {
            name = "cosmian-kms"
            version = "4.0.0"
            
            config = ts.CosmianKMSConfig {
                // Rust-based key management system
                server_config = {
                    bind_address = "0.0.0.0:9998"
                    tls_enabled = True
                    cert_path = "/etc/cosmian/server.crt"
                    key_path = "/etc/cosmian/server.key"
                }
                
                // Database backend
                database = {
                    type = "postgresql"
                    host = "localhost"
                    port = 5432
                    database_name = "cosmian_kms"
                    ssl_mode = "require"
                }
                
                // Security configuration
                security = {
                    default_key_algorithm = "AES256-GCM"
                    key_rotation_days = 90
                    audit_logging = True
                    hsm_enabled = False  // For demo, use software keys
                }
            }
            
            dependencies = ["kubernetes"]
            install_order = 4
        }
    ]
    
    // Secret management configuration
    secret_management = {
        provider = "cosmian-kms"
        
        kms_config = {
            server_url = "https://k8s-master-01:9998"
            auth_method = "certificate"
            client_cert_path = "/etc/provisioning/client.crt"
            client_key_path = "/etc/provisioning/client.key"
            ca_cert_path = "/etc/provisioning/ca.crt"
            timeout = 30
            verify_ssl = True
        }
        
        // Automatic key rotation
        rotation_policy = {
            enabled = True
            rotation_interval_days = 30
            grace_period_days = 7
        }
    }
    
    // AI integration configuration
    ai_provider = {
        enabled = True
        provider = "openai"  // or "claude", "generic"
        
        // Model configuration
        model_config = {
            model = "gpt-4"
            max_tokens = 2048
            temperature = 0.3
            timeout = 30
        }
        
        // Feature flags
        features = {
            enable_template_ai = True
            enable_query_ai = True
            enable_webhook_ai = False
        }
    }
    
    // Runtime configuration
    runtime = {
        wait = True
        output_format = "human"  // "yaml", "json"
        output_path = "tmp/rust-meetup-deploy"
        inventory_file = "./inventory.yaml"
        use_time = True
        
        // Deployment strategy
        deployment = {
            strategy = "rolling"
            max_unavailable = 1
            health_check_timeout = 300
            rollback_on_failure = True
        }
    }
    
    // Cost optimization settings
    cost_optimization = {
        auto_scaling = {
            enabled = True
            min_nodes = 2
            max_nodes = 5
            target_cpu_utilization = 70
        }
        
        scheduling = {
            spot_instances = True
            spot_max_price = 0.05  // USD per hour
            on_demand_base = 1     // Always keep 1 on-demand
        }
        
        resource_tags = {
            AutoShutdown = "20:00"
            Environment = "demo"
            BillingProject = "rust-meetup"
        }
    }
}

// Validation schemas and constraints
schema DemoValidation {
    // Ensure we don't exceed demo budget
    check max([server.hardware.cpu_cores for server in config.servers]) <= 4, "Max 4 CPU per server for demo"
    check len(config.servers) <= 5, "Max 5 servers for demo"
    check all(server.metadata.backup_enabled == False for server in config.servers), "Backup disabled for demo"
    
    // Network validation
    check config.network.vpc_cidr in ["10.0.0.0/16", "172.16.0.0/16"], "Use private CIDR ranges"
    check all(subnet.cidr in config.network.vpc_cidr for subnet in config.network.subnets), "Subnets must be within VPC CIDR"
    
    // Security validation
    check config.secret_management.kms_config.verify_ssl == True, "SSL verification required"
    check config.ai_provider.features.enable_webhook_ai == False, "Webhook AI disabled for security"
}

// Apply validation
validation = DemoValidation {}